From 39d909992ed71d1d0849a70de3d06902b061348c Mon Sep 17 00:00:00 2001 From: Scrutora Date: Wed, 8 Jul 2026 18:21:07 +0530 Subject: [PATCH 1/2] Add Scrutora Scan code-scanning starter workflow --- .../properties/scrutora-scan.properties.json | 7 +++ code-scanning/scrutora-scan.yml | 45 +++++++++++++++++++ icons/scrutora.svg | 17 +++++++ 3 files changed, 69 insertions(+) create mode 100644 code-scanning/properties/scrutora-scan.properties.json create mode 100644 code-scanning/scrutora-scan.yml create mode 100644 icons/scrutora.svg diff --git a/code-scanning/properties/scrutora-scan.properties.json b/code-scanning/properties/scrutora-scan.properties.json new file mode 100644 index 0000000000..066a961d8d --- /dev/null +++ b/code-scanning/properties/scrutora-scan.properties.json @@ -0,0 +1,7 @@ +{ + "name": "Scrutora Scan", + "creator": "Scrutora", + "description": "Offline DPDPA, HIPAA, GDPR, PCI-DSS and RBI compliance scanning. No API key, your code never leaves the runner. Results upload to Code Scanning as SARIF.", + "iconName": "scrutora", + "categories": ["Code Scanning", "Python", "JavaScript", "TypeScript", "Java", "Go"] +} diff --git a/code-scanning/scrutora-scan.yml b/code-scanning/scrutora-scan.yml new file mode 100644 index 0000000000..367ade3ee9 --- /dev/null +++ b/code-scanning/scrutora-scan.yml @@ -0,0 +1,45 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. +# +# Scrutora Scan runs an offline, compliance-mapped scan of your code (DPDPA, +# HIPAA, GDPR, PCI-DSS, RBI). No API key is required and your code never leaves +# the runner. Findings are uploaded to GitHub Code Scanning as SARIF. +# See https://github.com/Scrutora/scrutora-scan +name: Scrutora Scan + +on: + push: + branches: [ "$default-branch" ] + pull_request: + branches: [ "$default-branch" ] + schedule: + - cron: $cron-weekly + +permissions: + contents: read + +jobs: + scrutora-scan: + name: Scrutora compliance scan + runs-on: ubuntu-latest + permissions: + contents: read + security-events: write # to upload SARIF to Code Scanning + actions: read # only needed by upload-sarif on private repos + steps: + - name: Checkout + uses: actions/checkout@v4 + + - name: Run Scrutora Scan + uses: Scrutora/scrutora-scan@v1 + with: + frameworks: dpdpa,hipaa + fail-on: none # report only; set to high/critical to gate the build + + - name: Upload SARIF to Code Scanning + if: always() + uses: github/codeql-action/upload-sarif@v3 + with: + sarif_file: scrutora.sarif diff --git a/icons/scrutora.svg b/icons/scrutora.svg new file mode 100644 index 0000000000..afa81349bf --- /dev/null +++ b/icons/scrutora.svg @@ -0,0 +1,17 @@ + + + + + + + + + + + + + From b748294095fad461659018437e63cb31c75653db Mon Sep 17 00:00:00 2001 From: Scrutora Date: Wed, 8 Jul 2026 18:28:36 +0530 Subject: [PATCH 2/2] Address review: unquoted branch placeholders + protected-branches, drop RBI (not in action docs), upload SARIF via action output --- .../properties/scrutora-scan.properties.json | 2 +- code-scanning/scrutora-scan.yml | 11 ++++++----- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/code-scanning/properties/scrutora-scan.properties.json b/code-scanning/properties/scrutora-scan.properties.json index 066a961d8d..6f5e50cea5 100644 --- a/code-scanning/properties/scrutora-scan.properties.json +++ b/code-scanning/properties/scrutora-scan.properties.json @@ -1,7 +1,7 @@ { "name": "Scrutora Scan", "creator": "Scrutora", - "description": "Offline DPDPA, HIPAA, GDPR, PCI-DSS and RBI compliance scanning. No API key, your code never leaves the runner. Results upload to Code Scanning as SARIF.", + "description": "Offline DPDPA, HIPAA, GDPR and PCI-DSS compliance scanning. No API key, your code never leaves the runner. Results upload to Code Scanning as SARIF.", "iconName": "scrutora", "categories": ["Code Scanning", "Python", "JavaScript", "TypeScript", "Java", "Go"] } diff --git a/code-scanning/scrutora-scan.yml b/code-scanning/scrutora-scan.yml index 367ade3ee9..4636f60cb2 100644 --- a/code-scanning/scrutora-scan.yml +++ b/code-scanning/scrutora-scan.yml @@ -4,16 +4,16 @@ # documentation. # # Scrutora Scan runs an offline, compliance-mapped scan of your code (DPDPA, -# HIPAA, GDPR, PCI-DSS, RBI). No API key is required and your code never leaves -# the runner. Findings are uploaded to GitHub Code Scanning as SARIF. +# HIPAA, GDPR, PCI-DSS). No API key is required and your code never leaves the +# runner. Findings are uploaded to GitHub Code Scanning as SARIF. # See https://github.com/Scrutora/scrutora-scan name: Scrutora Scan on: push: - branches: [ "$default-branch" ] + branches: [ $default-branch, $protected-branches ] pull_request: - branches: [ "$default-branch" ] + branches: [ $default-branch ] schedule: - cron: $cron-weekly @@ -33,6 +33,7 @@ jobs: uses: actions/checkout@v4 - name: Run Scrutora Scan + id: scan uses: Scrutora/scrutora-scan@v1 with: frameworks: dpdpa,hipaa @@ -42,4 +43,4 @@ jobs: if: always() uses: github/codeql-action/upload-sarif@v3 with: - sarif_file: scrutora.sarif + sarif_file: ${{ steps.scan.outputs.sarif-file }}